From: Roberto Sassu <roberto.sassu@huaweicloud.com>
To: corbet@lwn.net, zohar@linux.ibm.com, dmitry.kasatkin@gmail.com,
paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com
Cc: linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org,
linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org, bpf@vger.kernel.org,
jarkko@kernel.org, pbrobinson@gmail.com, zbyszek@in.waw.pl,
hch@lst.de, mjg59@srcf.ucam.org, pmatilai@redhat.com,
jannh@google.com, Roberto Sassu <roberto.sassu@huawei.com>
Subject: [RFC][PATCH v2 01/13] ima: Introduce hook DIGEST_LIST_CHECK
Date: Sat, 12 Aug 2023 12:46:04 +0200 [thread overview]
Message-ID: <20230812104616.2190095-2-roberto.sassu@huaweicloud.com> (raw)
In-Reply-To: <20230812104616.2190095-1-roberto.sassu@huaweicloud.com>
From: Roberto Sassu <roberto.sassu@huawei.com>
Introduce a new hook to check the integrity of digest lists, whose digests
are added to the digest cache.
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
---
Documentation/ABI/testing/ima_policy | 1 +
include/linux/kernel_read_file.h | 1 +
security/integrity/ima/ima.h | 1 +
security/integrity/ima/ima_main.c | 3 ++-
security/integrity/ima/ima_policy.c | 3 +++
5 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
index 49db0ff288e..14d92c687ef 100644
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -36,6 +36,7 @@ Description:
[KEXEC_KERNEL_CHECK] [KEXEC_INITRAMFS_CHECK]
[KEXEC_CMDLINE] [KEY_CHECK] [CRITICAL_DATA]
[SETXATTR_CHECK][MMAP_CHECK_REQPROT]
+ [DIGEST_LIST_CHECK]
mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
[[^]MAY_EXEC]
fsmagic:= hex value
diff --git a/include/linux/kernel_read_file.h b/include/linux/kernel_read_file.h
index 90451e2e12b..85f602e49e2 100644
--- a/include/linux/kernel_read_file.h
+++ b/include/linux/kernel_read_file.h
@@ -14,6 +14,7 @@
id(KEXEC_INITRAMFS, kexec-initramfs) \
id(POLICY, security-policy) \
id(X509_CERTIFICATE, x509-certificate) \
+ id(DIGEST_LIST, digest-list) \
id(MAX_ID, )
#define __fid_enumify(ENUM, dummy) READING_ ## ENUM,
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index c29db699c99..3aef3d8fb57 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -203,6 +203,7 @@ static inline unsigned int ima_hash_key(u8 *digest)
hook(KEY_CHECK, key) \
hook(CRITICAL_DATA, critical_data) \
hook(SETXATTR_CHECK, setxattr_check) \
+ hook(DIGEST_LIST_CHECK, digest_list_check) \
hook(MAX_CHECK, none)
#define __ima_hook_enumify(ENUM, str) ENUM,
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index 365db0e43d7..81abdc8b233 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -771,7 +771,8 @@ const int read_idmap[READING_MAX_ID] = {
[READING_MODULE] = MODULE_CHECK,
[READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK,
[READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK,
- [READING_POLICY] = POLICY_CHECK
+ [READING_POLICY] = POLICY_CHECK,
+ [READING_DIGEST_LIST] = DIGEST_LIST_CHECK,
};
/**
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index c9b3bd8f1bb..b32c83d8a72 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -1287,6 +1287,7 @@ static bool ima_validate_rule(struct ima_rule_entry *entry)
case MODULE_CHECK:
case KEXEC_KERNEL_CHECK:
case KEXEC_INITRAMFS_CHECK:
+ case DIGEST_LIST_CHECK:
if (entry->flags & ~(IMA_FUNC | IMA_MASK | IMA_FSMAGIC |
IMA_UID | IMA_FOWNER | IMA_FSUUID |
IMA_INMASK | IMA_EUID | IMA_PCR |
@@ -1530,6 +1531,8 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
entry->func = CRITICAL_DATA;
else if (strcmp(args[0].from, "SETXATTR_CHECK") == 0)
entry->func = SETXATTR_CHECK;
+ else if (strcmp(args[0].from, "DIGEST_LIST_CHECK") == 0)
+ entry->func = DIGEST_LIST_CHECK;
else
result = -EINVAL;
if (!result)
--
2.34.1
next prev parent reply other threads:[~2023-08-12 10:47 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-12 10:46 [RFC][PATCH v2 00/13] integrity: Introduce a digest cache Roberto Sassu
2023-08-12 10:46 ` Roberto Sassu [this message]
2023-08-12 10:46 ` [RFC][PATCH v2 02/13] " Roberto Sassu
2023-08-14 17:03 ` Jarkko Sakkinen
2023-08-16 8:21 ` Roberto Sassu
2023-08-16 20:39 ` Jarkko Sakkinen
2023-08-12 10:46 ` [RFC][PATCH v2 03/13] integrity/digest_cache: Add functions to populate and search Roberto Sassu
2023-08-14 17:13 ` Jarkko Sakkinen
2023-08-16 8:35 ` Roberto Sassu
2023-08-16 21:00 ` Jarkko Sakkinen
2023-08-12 10:46 ` [RFC][PATCH v2 04/13] integrity/digest_cache: Prefetch digest lists in a directory Roberto Sassu
2023-08-12 10:46 ` [RFC][PATCH v2 05/13] integrity/digest_cache: Parse tlv digest lists Roberto Sassu
2023-08-12 10:46 ` [RFC][PATCH v2 06/13] integrity/digest_cache: Parse rpm " Roberto Sassu
2023-08-12 10:46 ` [RFC][PATCH v2 07/13] ima: Add digest_cache policy keyword Roberto Sassu
2023-08-12 10:46 ` [RFC][PATCH v2 08/13] ima: Use digest cache for measurement Roberto Sassu
2023-08-12 10:46 ` [RFC][PATCH v2 09/13] ima: Use digest cache for appraisal Roberto Sassu
2023-08-12 10:46 ` [RFC][PATCH v2 10/13] tools: Add tool to manage digest lists Roberto Sassu
2023-08-12 10:46 ` [RFC][PATCH v2 11/13] tools/digest-lists: Add tlv digest list generator and parser Roberto Sassu
2023-08-12 10:46 ` [RFC][PATCH v2 12/13] tools/digest-lists: Add rpm " Roberto Sassu
2023-08-12 10:46 ` [RFC][PATCH v2 13/13] docs: Add documentation of the integrity digest cache Roberto Sassu
2023-09-05 15:46 ` [RFC][PATCH v2 00/13] integrity: Introduce a " Roberto Sassu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230812104616.2190095-2-roberto.sassu@huaweicloud.com \
--to=roberto.sassu@huaweicloud.com \
--cc=bpf@vger.kernel.org \
--cc=corbet@lwn.net \
--cc=dmitry.kasatkin@gmail.com \
--cc=hch@lst.de \
--cc=jannh@google.com \
--cc=jarkko@kernel.org \
--cc=jmorris@namei.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mjg59@srcf.ucam.org \
--cc=paul@paul-moore.com \
--cc=pbrobinson@gmail.com \
--cc=pmatilai@redhat.com \
--cc=roberto.sassu@huawei.com \
--cc=serge@hallyn.com \
--cc=zbyszek@in.waw.pl \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).